Hackers Can Steal 2fa Codes and Private Messages From Android Phones

Yes.

They're called rubber mallets and they are useful in a number of situations where you want to

> I would hope a malicious app I willingly installed will be able to behave maliciously.

You should be able to install an app that has continuous access to your screen but that doesn't mean that continuous access to your screen is something you should have to grant to every piece of software that runs on your computer.

I think this is the part people are upset about

In Windows installing malware compromises other applications, while in Android, your other apps are safe. In this news, this security mechanism fails. To denounce that the mechanism is completely useless is quite stupid, you just outed yourself as someone who doesn't have any security responsibilities and shouldn't have.

The obvious joke, how long has Facebook been using this exploit?

First it requires the user take buckets of ammonia and bleach and mix them together.

PD: I just checked and it also doesn't change the color of the pressed keys or any other visual feedback that an attacker might use.

I think it speaks about the security of Android that this makes the news. Coming from Windows, Android always felt as a MUCH more secure Operating System, not just a similar quality Operating System with touch controls and support for smaller hardware.

This doesn't apply in this case, as (usermode apps') screen capturing does require permission, and applications can specifically opt-out from being captured by apps even with that permission, which Google Authenticator does have set. So a trust boundary is being violated, therefore this is a legitimate security issue by his logic.

Edit: IIRC the original argument was more reasonable, but it has since been abused in all kinds of situations to make low effort putdowns, like this one.

> Google has attempted to patch Pixnapping by limiting the number of activities an app can invoke blur on. However, we discovered a workaround to make Pixnapping work despite this patch. The workaround is still under embargo.

Great, google's security policy ending up being a zeroday. Exactly as denied and exactly as predicted by the community.

Also, this is the direct paper link: https://www.pixnapping.com/pixnapping.pdf

From the paper:

Recall from Section 2.1 that when a caller activity sends an intent to a callee activity, Android moves the callee activity to the foreground (along with its task’s back stack if android:-launchMode="singleTask") and moves the caller activity to the background.

However, despite no longer being in the foreground, the caller activity is still allowed to send intents that start additional activities from the background. For example, the caller activity can send another intent to launch a second callee activity.

In this case, the second callee moves to the foreground, while the first callee is moved to the background. Further, SurfaceFlinger treats the window of the second callee as being overlaid in front of the window of the first callee.

In our framework, the attacker app leverages this behavior to layer a stack of semi-transparent activities in front of a newly launched victim activity. In the following, we describe how the attacker uses this stack and SurfaceFlinger’s APIs to isolate, enlarge, and transmit individual pixels from the victim activity.

The patch was committed about 3 months ago, possibly available to OEMs as binary earlier, but devices are probably just receiving these patches.

I bet at least half of all affected Android devices in the world have not got the patch yet if I am optimistic. It's probably near 80-90%.

... has not been (effectively) patched against, as it happens. Maybe in December!

Wayland, once hardened with security-context doesn't directly expose anything worrying (clipboard stealing is possible but would require window focus or the generation of a window which grabs focus). It remains to be seen if there are side-channels hiding somewhere in it or in the various GPU stacks.